kernel/linux.git/include/media/dvb_net.h, branch v6.1.168Linux kernel stable tree (mirror)https://git.radix-linux.su/kernel/linux.git/atom?h=v6.1.1682023-06-09T08:34:12+00:00media: dvb-core: Fix use-after-free due on race condition at dvb_net2023-06-09T08:34:12+00:00Hyunwoo Kimimv4bel@gmail.com2022-11-17T04:59:23+00:00urn:sha1:93b5dfebcb1821dde466e29404fcf1fb919f4c72
[ Upstream commit 4172385b0c9ac366dcab78eda48c26814b87ed1a ]
A race condition may occur between the .disconnect function, which
is called when the device is disconnected, and the dvb_device_open()
function, which is called when the device node is open()ed.
This results in several types of UAFs.
The root cause of this is that you use the dvb_device_open() function,
which does not implement a conditional statement
that checks 'dvbnet->exit'.
So, add 'remove_mutex` to protect 'dvbnet->exit' and use
locked_dvb_net_open() function to check 'dvbnet->exit'.
[mchehab: fix a checkpatch warning]
Link: https://lore.kernel.org/linux-media/20221117045925.14297-3-imv4bel@gmail.com
Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
media: move dvb kAPI headers to include/media2017-12-28T18:16:01+00:00Mauro Carvalho Chehabmchehab@s-opensource.com2017-12-28T18:03:51+00:00urn:sha1:fada1935590f66dc6784981e0d557ca09013c847
Except for DVB, all media kAPI headers are at include/media.
Move the headers to it.
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>